lgoogloader | 698d902b9552dad46b248acb1c6674a53ac14d7e90764f7d0a70f02e636cebeb

Analysis

max time kernel
133s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2023 08:31

Target

ed75cea904ef453eef6c9920ce3c93b5.exe
Size

538KB
MD5

ed75cea904ef453eef6c9920ce3c93b5
SHA1

c4413aa90f798fef7c178790599f9d3e64d6e614
SHA256

698d902b9552dad46b248acb1c6674a53ac14d7e90764f7d0a70f02e636cebeb
SHA512

a18d9dec591b0643497490b1b727a7ad9c83718bfde383356151c7142dec9996c4b5ea2b67e311778c872f051cb23a30349a463978f959efc4b6e0f8be307287
SSDEEP

12288:NbXdzhaf9b+sDwHsI0Z/xPs0gKTD2160PKe+QZpBG:nVafZ+QQsI03Ps0XTD6rTA

Score

10^/10

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral2/memory/1300-8-0x00000000027E0000-0x00000000027ED000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2660 set thread context of 1300	2660	ed75cea904ef453eef6c9920ce3c93b5.exe	83

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1300	2660	ed75cea904ef453eef6c9920ce3c93b5.exe	83
PID 2660 wrote to memory of 1300	2660	ed75cea904ef453eef6c9920ce3c93b5.exe	83
PID 2660 wrote to memory of 1300	2660	ed75cea904ef453eef6c9920ce3c93b5.exe	83
PID 2660 wrote to memory of 1300	2660	ed75cea904ef453eef6c9920ce3c93b5.exe	83
PID 2660 wrote to memory of 1300	2660	ed75cea904ef453eef6c9920ce3c93b5.exe	83
PID 2660 wrote to memory of 1300	2660	ed75cea904ef453eef6c9920ce3c93b5.exe	83
PID 2660 wrote to memory of 1300	2660	ed75cea904ef453eef6c9920ce3c93b5.exe	83
PID 2660 wrote to memory of 1300	2660	ed75cea904ef453eef6c9920ce3c93b5.exe	83
PID 2660 wrote to memory of 1300	2660	ed75cea904ef453eef6c9920ce3c93b5.exe	83
PID 2660 wrote to memory of 1300	2660	ed75cea904ef453eef6c9920ce3c93b5.exe	83
PID 2660 wrote to memory of 1300	2660	ed75cea904ef453eef6c9920ce3c93b5.exe	83

C:\Users\Admin\AppData\Local\Temp\ed75cea904ef453eef6c9920ce3c93b5.exe
"C:\Users\Admin\AppData\Local\Temp\ed75cea904ef453eef6c9920ce3c93b5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1300

memory/1300-4-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1300-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1300-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1300-7-0x0000000000B10000-0x0000000000B19000-memory.dmp

Filesize
36KB

Download
memory/1300-8-0x00000000027E0000-0x00000000027ED000-memory.dmp

Filesize
52KB

Download
memory/2660-0-0x00000216E54C0000-0x00000216E554A000-memory.dmp

Filesize
552KB

Download
memory/2660-1-0x00007FFD23BB0000-0x00007FFD24671000-memory.dmp

Filesize
10.8MB

Download
memory/2660-2-0x00000216FFCB0000-0x00000216FFCC0000-memory.dmp

Filesize
64KB

Download
memory/2660-9-0x00007FFD23BB0000-0x00007FFD24671000-memory.dmp

Filesize
10.8MB

Download
memory/2660-10-0x00000216FFCB0000-0x00000216FFCC0000-memory.dmp

Filesize
64KB

Download